docs(security): rely on Xray/ECR for container vuln scanning

- Remove Trivy/Snyk/Docker Scout examples from rules and skills
- Replace with guidance to enforce scanning in JFrog Xray or AWS ECR enhanced scanning (Inspector)
- Clean up CI snippet examples to avoid ad-hoc scanner references

Author: d-padmanabhan

rules/100-core.mdc

@@ -782,7 +782,7 @@ func processFile(filename string) error {
 - Run as non-root user (avoid `USER root`).
 - Pin base image versions (`python:3.12.1-slim`, not `python:latest`).
 - Use `.dockerignore` to exclude unnecessary files.
-- Scan images for vulnerabilities (`docker scout`, `trivy`).
+- Scan images for vulnerabilities via centralized scanning gates (JFrog Xray / AWS ECR enhanced scanning).
 - Minimize layers (combine `RUN` commands with `&&`).
 
 **JavaScript/TypeScript:**

rules/160-github-actions.mdc

@@ -1044,21 +1044,12 @@ jobs:
   uses: github/codeql-action/analyze@v3
 ```
 
-**Dependency Scanning:**
-```yaml
-- name: Run Trivy vulnerability scanner
-  uses: aquasecurity/trivy-action@master
-  with:
-    scan-type: 'fs'
-    scan-ref: '.'
-    format: 'sarif'
-    output: 'trivy-results.sarif'
+**Dependency / artifact vulnerability scanning:**
 
-- name: Upload to Security tab
-  uses: github/codeql-action/upload-sarif@v3
-  with:
-    sarif_file: 'trivy-results.sarif'
-```
+Prefer centralized, registry-native scanning and enforcement rather than ad-hoc CI scanners:
+
+- **JFrog Artifactory**: enforce vulnerability policies with **JFrog Xray** (block promotion/deploy on HIGH/CRITICAL)
+- **AWS ECR**: enforce **Enhanced scanning (Amazon Inspector)** findings (block deploy on findings)
 
 ---
 

rules/310-security.mdc

@@ -465,34 +465,10 @@ updates:
 
 **Lock File Scanning**
 
-```yaml
-# GitHub Actions - Vulnerability scanning
-name: Security Scan
+Use language/package-ecosystem native tools (example: `npm audit`) and enforce container image vulnerability scanning in the registry:
 
-on: [push, pull_request]
-
-jobs:
-  scan:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Run Snyk
-        uses: snyk/actions/node@master
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-
-      - name: Run npm audit
-        run: npm audit --audit-level=high
-
-      - name: Run Trivy
-        uses: aquasecurity/trivy-action@master
-        with:
-          scan-type: 'fs'
-          scan-ref: '.'
-          format: 'sarif'
-          output: 'trivy-results.sarif'
-```
+- **JFrog Artifactory**: enforce vulnerability policies with **JFrog Xray** (block promotion/deploy on HIGH/CRITICAL)
+- **AWS ECR**: enforce **Enhanced scanning (Amazon Inspector)** findings (block deploy on findings)
 
 ---
 
@@ -931,18 +907,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
-        with:
-          scan-type: 'fs'
-          scan-ref: '.'
-          format: 'sarif'
-          output: 'trivy-results.sarif'
-
-      - name: Run Snyk
-        uses: snyk/actions/node@master
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+      # Container image vulnerability scanning should be enforced centrally:
+      # - JFrog Artifactory: JFrog Xray policies (block promotion/deploy)
+      # - AWS ECR: Enhanced scanning (Amazon Inspector) findings (block deploy)
 
       - name: Run GitGuardian
         uses: GitGuardian/ggshield-action@master

rules/440-docker.mdc

@@ -262,18 +262,13 @@ CMD ["python", "-m", "src.main"]
 
 ### Scan for Vulnerabilities
 ```bash
-# Trivy - scan for vulnerabilities
-trivy image myapp:latest
-
-# Trivy - fail on HIGH and CRITICAL
-trivy image --severity HIGH,CRITICAL --exit-code 1 myapp:latest
-
-# Snyk - scan and monitor
-snyk container test myapp:latest
-snyk container monitor myapp:latest
-
-# Docker Scout
-docker scout cves myapp:latest
+## Prefer registry-native scanning gates
+#
+# For container image vulnerability scanning, rely on a centralized scanner that
+# runs in your registry / artifact-promotion pipeline (not ad-hoc on laptops):
+#
+# - JFrog Artifactory: JFrog Xray policies (block promotion/deploy on HIGH/CRITICAL)
+# - AWS ECR: Enhanced scanning (Amazon Inspector) policies (block deploy on findings)
 ```
 
 ### Sign Images
@@ -684,18 +679,9 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-      - name: Scan with Trivy
-        uses: aquasecurity/trivy-action@master
-        with:
-          image-ref: ghcr.io/${{ github.repository }}:${{ steps.meta.outputs.version }}
-          format: 'sarif'
-          output: 'trivy-results.sarif'
-
-      - name: Upload Trivy results
-        uses: github/codeql-action/upload-sarif@v2
-        if: always()
-        with:
-          sarif_file: 'trivy-results.sarif'
+      # Vulnerability scanning should be enforced centrally in the registry:
+      # - JFrog Artifactory: JFrog Xray policies (block promotion/deploy)
+      # - AWS ECR: Enhanced scanning (Amazon Inspector) findings (block deploy)
 ```
 
 ---

skills/containers-orchestration/SKILL.md

@@ -20,7 +20,7 @@ description: Docker and container orchestration best practices for production-re
 | **Multi-Stage** | Required for compiled languages (Go, Rust, C++) |
 | **User** | Run as non-root (use `USER node` or create user) |
 | **Health Checks** | Always include `HEALTHCHECK` instruction |
-| **Scanning** | Trivy or Snyk before production |
+| **Scanning** | Registry-native scanning gates (JFrog Xray / AWS ECR enhanced scanning) |
 | **Signing** | Sign images with cosign or Docker Content Trust |
 
 ## Dockerfile Best Practices
@@ -183,18 +183,13 @@ CMD ["python", "-m", "src.main"]
 ### Scan for Vulnerabilities
 
 ```bash
-# Trivy - scan for vulnerabilities
-trivy image myapp:latest
-
-# Trivy - fail on HIGH and CRITICAL
-trivy image --severity HIGH,CRITICAL --exit-code 1 myapp:latest
-
-# Snyk - scan and monitor
-snyk container test myapp:latest
-snyk container monitor myapp:latest
-
-# Docker Scout
-docker scout cves myapp:latest
+## Prefer registry-native scanning gates
+#
+# For container image vulnerability scanning, rely on a centralized scanner that
+# runs in your registry / artifact-promotion pipeline (not ad-hoc on laptops):
+#
+# - JFrog Artifactory: JFrog Xray policies (block promotion/deploy on HIGH/CRITICAL)
+# - AWS ECR: Enhanced scanning (Amazon Inspector) policies (block deploy on findings)
 ```
 
 ## Health Checks

skills/containers-orchestration/references/docker.md

@@ -265,18 +265,13 @@ CMD ["python", "-m", "src.main"]
 ### Scan for Vulnerabilities
 
 ```bash
-# Trivy - scan for vulnerabilities
-trivy image myapp:latest
-
-# Trivy - fail on HIGH and CRITICAL
-trivy image --severity HIGH,CRITICAL --exit-code 1 myapp:latest
-
-# Snyk - scan and monitor
-snyk container test myapp:latest
-snyk container monitor myapp:latest
-
-# Docker Scout
-docker scout cves myapp:latest
+## Prefer registry-native scanning gates
+#
+# For container image vulnerability scanning, rely on a centralized scanner that
+# runs in your registry / artifact-promotion pipeline (not ad-hoc on laptops):
+#
+# - JFrog Artifactory: JFrog Xray policies (block promotion/deploy on HIGH/CRITICAL)
+# - AWS ECR: Enhanced scanning (Amazon Inspector) policies (block deploy on findings)
 ```
 
 ### Sign Images
@@ -697,18 +692,9 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-      - name: Scan with Trivy
-        uses: aquasecurity/trivy-action@master
-        with:
-          image-ref: ghcr.io/${{ github.repository }}:${{ steps.meta.outputs.version }}
-          format: 'sarif'
-          output: 'trivy-results.sarif'
-
-      - name: Upload Trivy results
-        uses: github/codeql-action/upload-sarif@v2
-        if: always()
-        with:
-          sarif_file: 'trivy-results.sarif'
+      # Vulnerability scanning should be enforced centrally in the registry:
+      # - JFrog Artifactory: JFrog Xray policies (block promotion/deploy)
+      # - AWS ECR: Enhanced scanning (Amazon Inspector) findings (block deploy)
 ```
 
 ---

skills/infrastructure-iac/references/docker.md

@@ -162,9 +162,13 @@ LABEL org.opencontainers.image.revision="${GIT_SHA}"
 ## Security Scanning
 
 ```bash
-# Scan for vulnerabilities
-docker scout cves myimage:latest
-trivy image myimage:latest
+## Prefer registry-native scanning gates
+#
+# For container image vulnerability scanning, rely on a centralized scanner that
+# runs in your registry / artifact-promotion pipeline (not ad-hoc on laptops):
+#
+# - JFrog Artifactory: JFrog Xray policies (block promotion/deploy on HIGH/CRITICAL)
+# - AWS ECR: Enhanced scanning (Amazon Inspector) policies (block deploy on findings)
 
 # Lint Dockerfile
 hadolint Dockerfile

skills/security-testing/references/owasp-security.md

@@ -431,7 +431,13 @@ updates:
 **Lock File Scanning:**
 
 ```yaml
-# GitHub Actions - Vulnerability scanning
+# GitHub Actions - Vulnerability scanning (example pattern)
+#
+# Prefer registry-native scanning/enforcement for container images:
+# - JFrog Artifactory: JFrog Xray policies (block promotion/deploy on HIGH/CRITICAL)
+# - AWS ECR: Enhanced scanning (Amazon Inspector) findings (block deploy on findings)
+#
+# Keep language/package native scanning in CI (example: npm audit) as appropriate.
 name: Security Scan
 
 on: [push, pull_request]
@@ -441,22 +447,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-
-      - name: Run Snyk
-        uses: snyk/actions/node@master
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-
       - name: Run npm audit
         run: npm audit --audit-level=high
-
-      - name: Run Trivy
-        uses: aquasecurity/trivy-action@master
-        with:
-          scan-type: 'fs'
-          scan-ref: '.'
-          format: 'sarif'
-          output: 'trivy-results.sarif'
 ```
 
 ---
@@ -845,18 +837,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Run Trivy
-        uses: aquasecurity/trivy-action@master
-        with:
-          scan-type: 'fs'
-          scan-ref: '.'
-          format: 'sarif'
-          output: 'trivy-results.sarif'
-
-      - name: Run Snyk
-        uses: snyk/actions/node@master
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+      # Container image vulnerability scanning should be enforced centrally:
+      # - JFrog Artifactory: JFrog Xray policies (block promotion/deploy)
+      # - AWS ECR: Enhanced scanning (Amazon Inspector) findings (block deploy)
 
       - name: Run Bandit (Python)
         run: |